clet.xyz

In late 2024, a significant collaborative effort was launched to enhance the security posture of the Ethereum ecosystem. The Ethereum Foundation, in partnership with prominent security organizations Secureum, The Red Guild, and Security Alliance (SEAL), introduced the ETH Rangers Program. This groundbreaking initiative was designed to provide crucial financial stipends to individuals actively engaged in public goods security work within the Ethereum network. The program’s overarching objective was to foster and fund independent efforts that directly contribute to the resilience of Ethereum, while simultaneously recognizing individuals who have a proven track record of making substantial contributions to vital security work that benefits the entire ecosystem.

The six-month ETH Rangers Program has now concluded, yielding a diverse and impressive array of outcomes from its 17 stipend recipients. The scope of their work spans critical areas including in-depth vulnerability research, the development of essential security tooling, comprehensive educational initiatives, sophisticated threat intelligence gathering, and responsive incident management. The consolidated results underscore a fundamental truth: securing a decentralized network like Ethereum necessitates a decentralized defense strategy. These independent researchers, through their dedicated efforts, have built foundational infrastructure and disseminated knowledge that will amplify security benefits across the entire Ethereum landscape, from the core protocol level to global developer education.

Genesis and Objectives of the ETH Rangers Program

The inception of the ETH Rangers Program was a direct response to the growing need for sustained, independent security contributions within the rapidly evolving Ethereum ecosystem. As the network scales and its adoption broadens, so too do the potential attack surfaces and the sophistication of threats. Recognizing that security is a continuous and multifaceted endeavor, the Ethereum Foundation, alongside its partner organizations, sought to create a structured program that could systematically identify and support individuals making tangible contributions to this crucial area.

The program’s design emphasized supporting "public goods" – work that benefits the entire community without necessarily yielding direct commercial returns for the contributor. This philosophical alignment was key to ensuring that the funded projects would have the broadest possible positive impact. The partnership with Secureum, The Red Guild, and SEAL brought together organizations with deep expertise in security research, community building, and threat analysis, creating a robust framework for evaluating proposals and overseeing the program’s execution.

The selection process prioritized individuals or small teams with demonstrable past contributions to Ethereum security. This ensured that the stipends would empower those already deeply invested and knowledgeable, allowing them to accelerate their ongoing work or embark on new, high-impact projects. The program aimed not only to provide financial support but also to elevate the visibility and recognition of these critical security contributors, fostering a more robust and collaborative security culture within Ethereum.

Project Highlights: A Decentralized Defense in Action

The outcomes of the ETH Rangers Program paint a compelling picture of the decentralized defense strategy in practice. The 17 recipients’ work represents a significant expansion of Ethereum’s security capabilities across multiple domains.

SunSec – DeFiHackLabs: Amplifying Security Education and Tooling

SunSec, in collaboration with the vibrant DeFiHackLabs community, delivered an extraordinary volume of work focused on security education and tooling. During the stipend period, DeFiHackLabs achieved several significant milestones:

• Published 30+ in-depth security articles and tutorials: These resources covered a wide range of topics, from smart contract vulnerability analysis to secure coding practices for decentralized applications (dApps).
• Developed and released 5 new open-source security tools: These tools aimed to assist developers and auditors in identifying common vulnerabilities and improving the security of their projects.
• Organized 10 community-led security workshops: These sessions provided hands-on training and knowledge sharing opportunities for hundreds of aspiring and experienced security researchers.
• Created a comprehensive vulnerability database: This database aggregated and categorized known vulnerabilities in DeFi protocols, serving as a valuable reference for the community.

The sheer scale of community activation demonstrated by DeFiHackLabs is particularly noteworthy. Operating as a force multiplier, the project transformed a single stipend into a widespread educational output that reached and empowered hundreds of security researchers. This grassroots approach to security education is instrumental in building a more security-conscious developer base.

Ketman Project – DPRK IT Worker Investigations: Mitigating a Critical Threat

One recipient dedicated their stipend to significantly scaling the Ketman Project, an initiative focused on identifying and mitigating the presence of North Korean (DPRK) IT workers who have infiltrated blockchain projects under false identities. This is a pressing operational security threat that has been a growing concern for the global blockchain community. Over the stipend period, the Ketman Project achieved the following:

• Developed and deployed advanced analytics tools: These tools are designed to detect patterns and anomalies indicative of DPRK state-sponsored activity within blockchain networks and developer communities.
• Published detailed reports on identified infiltration tactics: These reports provided actionable intelligence to project teams and law enforcement agencies, outlining the methods used by DPRK actors.
• Collaborated with multiple blockchain projects: The project provided direct assistance to several projects in identifying and subsequently expelling suspected DPRK operatives, thereby safeguarding their assets and intellectual property.
• Established a secure information-sharing channel: This channel facilitated real-time communication and intelligence sharing among security professionals and organizations concerned with this specific threat vector.

This work directly addresses one of the most significant and insidious operational security threats currently facing the Ethereum ecosystem and the broader blockchain industry. By proactively identifying and disrupting these infiltration efforts, the Ketman Project is playing a crucial role in protecting the integrity of decentralized systems.

Nick Bax – Incident Response and Threat Intelligence: A Multi-Faceted Contribution

Nick Bax made significant contributions across multiple critical security domains, primarily through his involvement with SEAL 911 incident response, DPRK threat mitigation efforts, and public awareness campaigns. His work during the stipend period included:

• Active participation in SEAL 911 incident response: Bax was instrumental in responding to and documenting numerous security incidents affecting the Ethereum ecosystem, providing rapid analysis and mitigation strategies.
• Developing enhanced threat intelligence on DPRK activities: Building upon existing efforts, he refined methodologies for tracking and attributing North Korean cyber threats targeting the blockchain space.
• Creating educational content on threat landscapes: Bax authored articles and presented findings on emerging threats, contributing to the broader community’s understanding of the evolving security landscape.
• Assisting in the development of security frameworks: He contributed to the ongoing development and refinement of security best practices and frameworks within the Security Alliance.

Bax’s broad engagement highlights the interconnectedness of various security disciplines. His ability to contribute to incident response, threat intelligence, and educational outreach demonstrates the value of versatile security professionals in a dynamic ecosystem.

Guild Audits – Security Education in Africa and Beyond: Building Capacity

Guild Audits focused its efforts on a critical aspect of long-term security: capacity building through education. The organization ran intensive smart contract security bootcamps, with the explicit goal of training the next generation of Ethereum security researchers. Their impact includes:

• Graduating over 150 security researchers: These individuals received comprehensive training in smart contract auditing, vulnerability analysis, and secure development practices.
• Establishing partnerships with universities and coding bootcamps: This expansion broadened the reach of their educational programs, particularly in regions historically underrepresented in the global cybersecurity community.
• Developing a standardized curriculum for smart contract security: This curriculum is now available as an open-source resource, enabling other organizations to replicate and adapt their successful training model.
• Facilitating job placements for graduates: Guild Audits actively connected its graduates with opportunities within the Ethereum ecosystem, creating a tangible pipeline of skilled security talent.

The capacity-building impact of Guild Audits’ bootcamps is profound. By creating a pipeline of skilled security researchers, particularly in regions that have been historically underrepresented, they are significantly strengthening the global Ethereum security community and fostering greater diversity within the field.

Palina Tolmach – Kontrol: Usable Formal Verification: Enhancing Trust Through Rigor

Palina Tolmach, affiliated with Runtime Verification, focused on improving Kontrol, a sophisticated formal verification tool designed for Ethereum smart contracts. The goal was to make this powerful tool more accessible and user-friendly for a broader audience of developers and security researchers. Key improvements delivered to Kontrol include:

• Enhanced user interface and documentation: Significant efforts were made to simplify the user experience and provide clearer, more comprehensive documentation, lowering the barrier to entry for new users.
• Expanded support for EVM features: Kontrol’s capabilities were broadened to encompass a wider range of Ethereum Virtual Machine (EVM) features and complexities, increasing its utility for auditing more intricate smart contracts.
• Integration with popular development environments: The tool was integrated with common IDEs and development workflows, allowing for seamless incorporation into existing smart contract development processes.
• Development of tutorials and examples: A suite of practical tutorials and illustrative examples was created to guide users through the process of applying formal verification to their projects.

All of this work has been made open-source and is available on GitHub, significantly contributing to the formal verification tooling landscape. By making advanced verification techniques more accessible, Tolmach’s work enhances the overall trustworthiness and reliability of smart contracts deployed on Ethereum.

Ethereum Execution Client DoS Research: Fortifying Network Infrastructure

A dedicated research team developed a robust testing framework designed to systematically evaluate the resilience of Ethereum execution clients against message-flooding denial-of-service (DoS) attacks. This is a critical area of research, as the performance and availability of execution clients are foundational to the network’s operation. The team’s efforts yielded significant findings:

• Developed a comprehensive testing framework: This framework allowed for the simulation of realistic message-flooding scenarios across various network conditions.
• Tested all five major execution clients: The research encompassed Geth, Besu, Erigon, Nethermind, and Reth, providing a broad and comparative analysis.
• Discovered 14 bugs across different protocol layers: These vulnerabilities, identified through systematic testing, could potentially lead to client instability, network congestion, or even full node downtime.
• Identified specific attack vectors: The research pinpointed how message-flooding could exploit weaknesses in client handling of peer discovery, transaction propagation, and block synchronization.

The findings underscore a crucial reality: no single execution client is entirely immune to message-flooding attacks. The research highlights the necessity for continued development of effective countermeasures, such as adaptive rate-limiting mechanisms. The testing framework and the detailed results have been shared with the Ethereum Foundation’s Protocol Security team, providing valuable insights to inform further client security research and development.

Other Stipend Recipients: A Broad Spectrum of Security Contributions

While the detailed write-ups above highlight some of the most prominent projects, the ETH Rangers Program supported a total of 17 recipients, each contributing significantly to Ethereum’s security in diverse ways. These contributions span a wide array of security-related public goods, further demonstrating the program’s commitment to a holistic approach to ecosystem security.

• Kelsie Nabben authored a significant book based on extensive ethnographic research into decentralized digital security communities, including SEAL, providing invaluable sociological and practical insights into the field.
• The Mothra team developed Mothra, a Ghidra extension specifically designed for EVM bytecode reverse engineering, notably including support for EOF decompilation. They also published detailed technical documentation of their development process.
• SomaXBT produced a comprehensive four-part series on blockchain forensics and the crypto threat landscape, delving into fund tracing, attribution techniques, and open-source intelligence (OSINT) methodologies.
• Peter Kacherginsky launched BlockThreat, a platform dedicated to blockchain threat intelligence, which systematically analyzes past blockchain security incidents and their underlying root causes.
• Attack Vectors created attackvectors.org, an open-source and continuously updated guide detailing the most prevalent attack vectors in DeFi, alongside recommended prevention strategies. They also contributed to SEAL’s Wallet Security Framework and became a SEAL Steward.
• Tim Fan developed D2PFuzz, a framework for fuzzing the DevP2P protocol, incorporating differential testing across multiple execution layer clients. This framework successfully identified bugs through both single-client and cross-client testing.
• nft_dreww contributed through publishing security articles, hosting educational classes via Boring Security, and completing audits on various Ethereum public goods projects.
• Jean-Loïc Mugnier developed a Web3 transaction simulation Chrome extension designed to intercept and simulate transactions before they reach the wallet, alongside conducting research into simulation spoofing techniques.
• Alexandre Melo produced a series of security workshop videos covering topics such as fuzzing, smart accounts, AI-driven auditing, Solana security, and zero-knowledge proofs, disseminating valuable knowledge to a wider audience.
• Ho Nhut Minh enhanced CuEVM, a GPU-accelerated EVM implementation, by adding multi-GPU support and developing a Golang library for integration with the Medusa fuzzer, with benchmarks conducted on high-performance Nvidia H100 GPUs.
• Sergio Garcia built the Tracelon Monitoring Bot, a Telegram bot offering real-time block monitoring for Ethereum, Bitcoin, and Base, complete with alerts for ERC20 balance changes. He also continued his contributions to SEAL 911 incident response.

Looking Ahead: A Sustainable Model for Ecosystem Security

The ETH Rangers Program has demonstrably succeeded in its mission to support individuals engaged in the often unglamorous yet absolutely essential security work that underpins the Ethereum ecosystem. The remarkable diversity of their contributions serves as a powerful testament to the multifaceted nature of "public goods security" in practice. This extends far beyond merely identifying and patching vulnerabilities; it encompasses the crucial development of new tools, the dissemination of knowledge through comprehensive educational initiatives, the meticulous documentation of best practices, the rapid and effective response to security incidents, and the overall enhancement of the ecosystem’s resilience against evolving threats.

By strategically investing in and supporting public goods security work, the ETH Rangers Program has successfully integrated a wealth of new tools, cutting-edge research, and vital intelligence into the broader Ethereum ecosystem. This decentralized approach to defense not only strengthens the network’s security fabric but also provides a more stable and secure foundation for builders, developers, and users worldwide.

The Ethereum Foundation expresses profound gratitude to all 17 stipend recipients for their invaluable contributions. Special recognition is extended to The Red Guild for their hands-on involvement in meticulously reviewing submissions, structuring project milestones, and providing detailed, constructive feedback throughout the program’s duration. Furthermore, thanks are due to Secureum and Security Alliance for their essential collaboration in the establishment and successful execution of this vital initiative. The program’s success suggests a promising model for future endeavors aimed at bolstering the security and integrity of decentralized technologies.